install

Additional install commands

macOS

Homebrewverified · 100%

brew install ncmdump

local Homebrew formula metadata

MacPortsverified · 94%

sudo port install ncmdump

MacPorts ports tree · multimedia/ncmdump/Portfile · source: api.github.com

Windows

Windows Package Managerverified · 92%

winget install --id TaurusXin.ncmdump -e

Windows Package Manager source index · TaurusXin.ncmdump · source: cdn.winget.microsoft.com

overview

Package summary

Convert Netease Cloud Music ncm files to mp3/flac files

Project links

Commands and aliases

ncmdump

history

Project history and usage

ncmdump is a small C++ command-line converter for NetEase Cloud Music `.ncm` cache files. Its README describes converting downloaded NCM cache files to MP3 or FLAC and the Homebrew formula packages the same purpose.

Project history

The GitHub repository was created on 2021-10-06. The README says this C++ version was a cross-platform port and reproduction of the earlier anonymous5l/ncmdump project, which the README says had been deleted, and claims it was the earliest C++ version and first program on the market to support NCM conversion. Version 1.3.0 is called out in the README for fixing filenames containing UTF-8 characters such as Chinese, Japanese, Korean, and emoji, and for adding DLL builds for use from other languages.

Adoption history

ncmdump's adoption is concentrated in the NetEase Cloud Music ecosystem and Chinese-language toolchains. The GitHub page observed for this batch showed about 4.1k stars and 488 forks, while Homebrew, MacPorts, and winget packaging make the CLI available outside ad-hoc binary downloads. The Homebrew formula API response consulted for this July 2026 batch reported 68 install-on-request events in 30 days and 649 in 365 days.

How it is used

The README documents single-file conversion, multiple input files, directory mode with `-d`, recursive traversal with `-r`, output selection with `-o`, source deletion after successful processing with `-m`, and version/help flags. The maintainer has clarified in GitHub Discussions that the tool decrypts and extracts the original MP3 or FLAC data from the `.ncm` file rather than transcoding between formats.

Why package nerds care

ncmdump is a format-escape utility: valuable when a user's music files are locked in NetEase's `.ncm` wrapper and they want normal player/library compatibility. It is niche, but the packaging story matters because users often need a trusted binary instead of random converter sites.

Timeline

2021-10-06: GitHub repository created.
1.3.0: README notes full UTF-8 filename fixes and DLL build support.
2025-10-05: GitHub page observed release 1.5.1 as latest in the rendered releases panel.

Related projects

anonymous5l/ncmdump, ncmdump-go, ncmdump-gui, NetEase Cloud Music

Sources

security posture

Risk level: orange

infrastructure mutation or orchestration signal.

Risk classifier

orange risk · medium confidence · infrastructure

Why

infrastructure mutation or orchestration signal

Signals

text:cloud

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Installs with 1 runtime dependencies.
Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

Command	Kind	Exposure	Note
`ncmdump`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version1.5.1

manager updated

local dataok

upstreamcurrent

latest detected1.5.1

https://github.com/taurusxin/ncmdump

infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package key	brew:ncmdump
Version	1.5.1
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/ncmdump
Homepage	https://github.com/taurusxin/ncmdump
Repository	https://github.com/taurusxin/ncmdump
Upstream docs	https://github.com/taurusxin/ncmdump
License	MIT
Source archive	https://github.com/taurusxin/ncmdump/archive/refs/tags/1.5.1.tar.gz
Dependencies	taglib
Build dependencies	cmake
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	ncmdump
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

MacPorts95%

ncmdump

sudo port install ncmdump

normalized package name match
Matched by: Ncmdump

MacPorts ports tree · api.github.com · MacPorts ports tree: multimedia/ncmdump/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

winget95%

TaurusXin.ncmdump

winget install --id TaurusXin.ncmdump -e

normalized package name match
Matched by: Ncmdump

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: TaurusXin.ncmdump from https://cdn.winget.microsoft.com/cache/source.msix

winget95%

xiSage.ncmdump-net

winget install --id xiSage.ncmdump-net -e

normalized package name match
Matched by: Ncmdump

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: xiSage.ncmdump-net from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/ncmdump.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install ncmdump with Homebrew, MacPorts, winget